SellQuanta Code Signing Policy
This policy explains the current signing status of SellQuanta for Windows and how official releases will be signed once code signing is approved.
Last updated:
1. Current status
SellQuanta Windows installers are currently not code-signed. SellQuanta has not yet been approved by, and is not currently signed through, SignPath or any other code-signing service. No code-signing certificate has been issued for SellQuanta.
SellQuanta is currently unsigned. Windows SmartScreen may display an Unknown Publisher warning.
2. Planned signing
InfoBridgeIndia intends to apply for free code signing for open-source projects, for example through the SignPath Foundation. If and when signing is approved, this page will be updated and the rules below will apply.
3. What will be signed
Only binaries built by the public GitHub Actions workflow from the source code in the official repository, infobridgeindiaofficial-rgb/sellquanta, will be signed.
Signing will happen only for releases built from the main branch or from release tags. No locally built or modified binaries will be signed. Signing credentials will never be stored in the repository.
4. Roles
Committers and reviewers: maintainers of the official GitHub repository.
Approvers of release signing requests: the repository owner, InfoBridgeIndia.
All maintainers are expected to use multi-factor authentication on their GitHub accounts.
5. Privacy
SellQuanta does not transfer any information to networked systems unless specifically requested by the user or the person installing or operating it. It stores business data only on the local computer. The optional Ollama integration communicates only with the Ollama server URL configured by the user (by default the local machine, 127.0.0.1). See the SellQuanta Privacy Policy.
6. Source of this policy
This page reflects the CODE_SIGNING_POLICY.md file in the official repository, which remains the source of truth.